The curl quirk that exposed Burp Suite & Google Chrome

Published

2023-03-28 13:13

Collected

2026-07-27 07:13

---
id: 5451
title: "The curl quirk that exposed Burp Suite & Google Chrome"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/the-curl-quirk-that-exposed-burp-suite-amp-google-chrome"
published_at: "2023-03-28T13:13:00Z"
tags: ["burp-suite", "vulnerability-research", "web-security", "curl", "local-file-disclosure", "google-chrome"]
phying_url: "https://phying.com/item/5451"
lang: en
---

# The curl quirk that exposed Burp Suite & Google Chrome

## Summary

How curl's @-prefixed --data-binary turns data into a file read: the quirk let malicious requests exfiltrate local files through 'copy as curl' in Burp Suite Pro, and also affected Google Chrome.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-03-28T13:13:00Z
- **Original:** https://portswigger.net/research/the-curl-quirk-that-exposed-burp-suite-amp-google-chrome
- **Phying News:** https://phying.com/item/5451